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Executive  Summary 

Complex  systems  experience  dramatic  changes  in  behavior  and  can  undergo  transitions  from 
functional  to  dysfunctional  states.  External  forces,  structural  changes,  and  changes  in  a 
system’s  microdynamics  can  trigger  transitions  from  stability  to  instability.  An  unstable 
system  is  prone  to  dysfunctional  collective  cascades,  which  result  from  interactions  that 
generate  self-reinforcing  large-scale  behaviors  within  the  system.  Because  many  human 
and  technological  civilian  and  military  systems  today  are  complex  systems,  understanding 
their  susceptibility  to  collective  failure  is  a  critical  defense  problem. 

Understanding  vulnerability  in  complex  systems  requires  a  different  approach  from  tra¬ 
ditional  analysis,  which  fails  to  adequately  characterize  the  coupled  behaviors  at  multiple 
scales  of  cascading  failures.  Neuromorphic  methods,  which  are  modeled  on  the  pattern- 
recognition  circuitry  of  the  brain,  are  capable  of  finding  patterns  in  high  dimensional  data 
at  multiple  scales  and  without  the  limitations  of  traditional  techniques.  We  used  neuromor¬ 
phic  pattern-discovery  algorithms  to  develop  and  implement  methods  for  identifying  the 
vulnerabilities  of  complex  systems,  and  tested  the  methods  with  Internet2  network  data. 

From  a  variety  of  microdynamic  network  data,  we  extracted  a  dynamic  measure  of  the 
Internet2  network’s  collective  behaviors.  The  data  stream  was  parsed  for  extreme  events 
based  on  a  trigger  that  was  determined  using  historical  network  data  and  tuned  to  maxi¬ 
mize  the  number  of  identified  events  while  excluding  false  positives.  Finally,  dimensionality 
reduction  algorithms  were  used  to  find  patterns  common  to  the  events  and  to  determine 
which  characteristics  are  typical  of  functional  behaviors  and  which  are  specific  to  dysfunc¬ 
tional  network  behavior.  The  result  is  a  generic  pipeline  for  identifying  extreme  events  in 
high  dimensional  datasets. 

This  pipeline  successfully  distinguished  events  typical  of  system  dysfunction  from  events 
where  the  system  responded  successfully  to  high  demand.  We  found  that  the  success  of  our 
processing  pipeline  in  identifying  extreme  events  can  be  attributed  to  a  specific  signature 
of  system  vulnerability  and  functional  breakdown  —  the  persistence  of  abnormal  activity 
over  time.  In  contrast,  events  which  have  effective  system  response  are  characterized  by 
a  short  time  scale  deviation,  possibly  preceded  or  followed  by  smaller  deviations.  When 
the  dynamic  profiles  of  each  event  were  processed  using  pattern-discovery  algorithms,  this 
property  of  system  failure  was  revealed:  events  to  which  the  system  responded  effectively 
appeared  in  a  cluster  -  distinct  from  events  characteristic  of  system  dysfunction. 
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1  Introduction 

High  dimensional  complex  systems  are  comprised  of  large  numbers  of  interdependent  el¬ 
ements  [T].  When  high  dimensional  systems  perform  critical  tasks,  the  task  is  shared  by 
and  dynamically  allocated  among  the  components.  The  ability  to  distribute  function  dy¬ 
namically  enables  robust  functioning  in  a  highly  variable  environment,  but  breaks  down 
when  collective  loads  are  excessive,  or  when  local  failures  or  allocation  process  failures  lead 
to  cascading  failures  of  large  parts  of  the  system  as  a  whole.  Thus,  interdependence  is 
necessary  for  function,  but  at  the  same  time  leads  to  dysfunctions  associated  with  collec¬ 
tive  breakdowns.  Because  collective  failures  are  dynamic  and  emergent,  it  is  essential  to 
identify  when  they  occur  and  how  to  prevent  them  for  the  effective  operation  of  a  large 
number  of  critical  systems. 

Predicting  the  conditions  of  collective  failures  typically  requires  extensive  study  of  the 
system  and  an  understanding  of  both  general  dynamical  characteristics  and  specific  struc¬ 
tural  details.  This  is  apparent  in  the  limited  prediction  ability  of  such  well-known  collective 
failures  as  traffic  jams  and  gridlock  in  road  and  highway  systems.  Similar  issues  arise  in 
many  much  less  visible  systems,  including  power  grids;  water  supply  systems;  communica¬ 
tion  networks  (the  internet);  transportation  networks  (airlines,  trains,  shipping,  etc);  the 
global  financial  system;  manufacturing,  food  and  other  commodity  supply  systems;  and 
social  networks  and  organizations.  The  potential  impact  of  catastrophic  failures  in  such 
systems  has  led  to  interest  in  developing  detailed  models  of  the  systems,  but  not  principles 
for  evaluating  system  vulnerability. 

Generally,  interactions  among  a  system’s  elements  can  generate  collective  dysfunctions, 
and  operating  conditions  can  trigger  dramatic  changes  in  the  system’s  overall  behavior, 
such  as  cascading  failures.  When  a  system  is  highly  susceptible  to  behavioral  changes  of 
this  sort,  it  is  functionally  unstable. 

Vulnerable  systems  are  likely  to  transition  from  stability  to  instability.  Like  a  pencil 
on  its  tip,  a  vulnerable  system  will  collapse  if  it  experiences  a  sufficiently  large  deviation. 
By  contrast,  a  stable  system  can  restore  itself  to  its  equilibrium  state  when  perturbed,  like 
a  pendulum.  A  system  that  is  normally  stable  can  become  functionally  unstable  due  to 
changes  in  global  conditions  or  in  relationships  between  the  system’s  constituent  elements. 

Understanding  the  vulnerabilities  of  complex  systems  is  a  critical  defense  problem  be¬ 
cause  of  the  many  human  and  technological  systems  today  that  rely  on  distributed  function 
and  that  can  be  characterized  as  high  dimensional  complex  systems.  Currently,  responses 
to  failure  are  reactive  instead  of  proactive  because  we  do  not  have  a  generic  pipeline  for 
analyzing  high  dimensional  systems  and  anticipating  their  vulnerabilities.  The  goal  of  this 
project  is  to  develop  a  method  for  characterizing  and  anticipating  extreme  behavior  and 
system  failure,  and  to  test  it  on  a  specific  case  study. 
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Figure  1:  Depiction  of  the  pipeline.  Each  orange  arrow  represents  one  phase  of  the  four- 
step  process.  Step  1,  the  sensor  process,  converts  high  dimensional  heterogeneous  data 
into  a  structured  data  stream  representation.  Step  2,  the  attention  process,  determines  an 
attention  trigger,  extracts  high-dimensional  event  data,  and  applies  an  alignment  algorithm 
to  align  events  in  time.  The  result  is  a  high-dimensional  matrix.  Step  3,  the  pattern  pro¬ 
cess,  employs  pattern-discovery  algorithms  (gray  arrow)  to  convert  the  high  dimensional 
input  into  a  lower-dimensional  representation.  Step  4,  the  interpretation  process,  charac¬ 
terizes  the  domains  in  the  lower-dimensional  representation  space  and  makes  it  possible  to 
distinguish  normal  system  operations  from  system  vulnerability  or  failure. 
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Figure  2:  Backbone  hubs  on  the  Internet2  network  and  traffic  flow  links  between  them. 

2  Internet  2 

Transitions  from  stability  to  instability  are  manifest  in  the  Internet,  which  makes  it  a  suit¬ 
able  prototype  case  for  studying  the  dynamical  properties  of  high  dimensional  systems. 
A  central  function  of  the  Internet  is  to  enable  any  node  to  communicate  with  any  other 
node  transparently  and  without  significant  delays  or  lost  communication.  But  the  Internet 
architecture,  which  consists  of  a  network  of  routers  with  multiple  hops  between  end  nodes, 
sometimes  exhibits  collective  behaviors  that  make  transparent  end-to-end  connectivity  im¬ 
possible.  Such  aggregate  collective  phenomena  include  cascading  failures,  the  largest  of 
which  have  been  associated  with  worm  attacks  M,  and  “route  flapping,”  which  occurs 
when  a  router  fluctuates  quickly  between  routes  without  settling  into  an  effective  routing 
pattern  [3],  Other  such  phenomena  include  bottlenecks,  storms,  and  collective  oscillations. 

A  suitable  prototype  case  for  studying  the  dynamical  properties  of  the  Internet  is  the 
Internet2  network,  backbone  hubs  of  which  are  depicted  in  Figure  [2}  Internet2  is  a  collabo¬ 
ration  of  research  institutions  and  companies  that  require  high-speed  network  infrastructure 
for  communication.  The  Internet2  network  is  similar  to  the  Internet  in  design  and  func¬ 
tion,  but  smaller.  While  Internet2  is  partially  isolated  from  the  Internet,  it  uses  the  same 
protocols  for  routing  and  is  large  enough  to  manifest  collective  dysfunction  [B].  By  design, 
massive  volumes  of  network  data  can  be  collected  through  protocols  built  into  the  net¬ 
work,  so  extensive  data  about  traffic  on  Internet2  has  been  archived.  The  availability  of 
historical  data  makes  Internet2  a  suitable  laboratory  for  studying  the  collective  failure  of 
high-dimensional  systems. 

Internet2  data  archives  include  logs  of  routing  changes  in  the  network  issued  by  its 
communications  protocol,  Border  Gateway  Protocol  (BGP)  the  same  protocol  used  by 
routers  on  the  Internet  [6].  Under  BGP,  each  node  sends  updates  to  its  neighbors  about 
which  routes  are  most  efficient  for  transmitting  data.  As  the  traffic  demand  changes,  routes 
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can  become  overloaded.  Delays  are  detected  by  network  routers  that  read  messages  from 
other  routers.  When  delays  are  detected,  BGP  messages  are  sent  between  routers  so  that 
they  change  their  routing  tables  [6]. 

Consider  what  might  happen  during  a  speech  given  by  the  President  that  is  broadcast 
via  a  live  video  feed  from  Washington  and  is  of  interest  to  many  people  near  Kansas  City. 
Data  packets  may  be  transmitted  from  Washington,  through  Atlanta  and  Houston,  to 
Kansas  City  (see  Fig.  [2]).  The  resulting  spike  in  network  traffic  may  impede  traffic  from 
Indianapolis  to  Washington,  which  also  passes  through  Atlanta. 

To  overcome  this  problem,  Indianapolis  traffic  may  be  rerouted  through  Chicago  and 
New  York.  A  message  from  Atlanta  to  Indianapolis  forcing  this  routing  change  constitutes 
a  BGP  update.  The  number  of  updates  per  minute  varies  from  as  little  as  a  few  dozen 
to  several  thousand  depending  upon  the  volume  and  nature  of  network  activity.  System 
failure  occurs  if  the  network  experiences  unusually  high  update  volumes  without  settling 
into  an  effective  routing  pattern. 

A  simple  example  of  system  failure  is  one  that  occurs  in  self-generated  traffic  and 
route  osciilations,  where  if  one  route  is  overioaded,  the  system  dynamicaliy  reroutes  traffic. 
However,  rerouted  traffic  may  cause  overloading  and  delays  in  the  new  route  while  leaving 
the  older  route  underutilized.  Subsequent  rerouting  may  exacerbate  this  effect  by  inducing 
routing  osciliations  that  never  achieve  effective  system  utiiization. 

Update  fogs  can  in  principle  enable  an  observer  to  understand  the  network’s  dynamics. 
However,  a  single  update,  or  even  a  large  number  of  updates,  are  not  indicative  of  failure. 
Aggregate  behaviors  must  be  characterized  using  patterns  in  the  BGP  traffic  that  enable 
us  to  distinguish  poor  resource  utilization  and  failed  communications  from  effective  use  of 
bandwidth  and  successful  communications. 

BGP  updates  are  one  of  several  types  of  records  in  the  Internet2  archives.  A  central 
problem  in  developing  a  model  that  reveals  the  network’s  collective  behaviors  is  determining 
which  data  best  represent  the  system  and  which  can  be  ignored.  Additionally,  understand¬ 
ing  vulnerabilities  in  Internet2  requires  an  approach  that  recognizes  the  consequences  of 
dependencies  between  nodes.  Traditional  analysis,  which  focuses  on  individual  variables 
and  pair-wise  correlations,  is  not  sufficient  to  capture  the  system’s  collective  behaviors  and 
does  little  to  help  discriminate  between  useful  and  irrelevant  data  streams.  Furthermore,  it 
fails  to  account  for  collective  behaviors  at  multiple  scales,  which  can  only  be  characterized 
by  k-fold  correlations,  and  are  prohibitively  computationally  expensive  to  study  due  to  the 
combinatorial  number  of  correlations 


3  Neuromorphic  Method 

We  have  developed  a  process  that  addresses  the  limitations  of  analysis  by  employing 
neuromorphic  dynamic  pattern  discovery  methods  to  identify  extreme  behavior  in  high¬ 
dimensional  systems.  This  process  identifies  and  characterizes  the  differences  between 
patterns  of  collective  behavior  and  uses  them  to  recognize  instability. 

Neuromorphic  pattern  discovery  methods  are  designed  to  mimic  the  nervous  system’s 
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pattern-recognition  circuitry  using  computer  algorithms.  Our  approach  consists  of  four 
stages:  sensor,  attention  (event  detection),  pattern  finding,  and  interpretation  (classifica¬ 
tion).  Each  of  these  stages  is  analogous  to  a  specific  neurobiological  function. 

This  report  describes  the  successful  implementation  of  our  approach  but  does  not  de¬ 
scribe  the  multiple  methods  that  have  been  studied  in  order  to  develop  this  approach  DEI- 
These  studies  investigated  both  conceptual  and  practical  aspects  of  computational  anal¬ 
ysis.  Some  of  the  implementations  tested  in  order  to  identify  the  strategy  used  and  its 
refinement  were  performed  on  systems  other  than  the  Internet  2  data  reported  here. 

Optimization  of  the  method  has  been  performed  at  a  global  rather  than  a  local  scale, 
which  ensures  that  the  neuromorphic  method  retains  essential  information  while  eliminating 
unnecessary  or  redundant  information  at  each  stage  of  processing.  That  the  method  does 
not  require  optimization  at  each  stage  is  critical  to  its  widespread  applicability.  Thus,  in 
this  method,  no  attempt  is  made  at  each  phase  of  the  process  to  isolate  a  single  correct 
output,  because  a  multiplicity  of  potential  outputs  can,  after  the  interpretation  process  has 
been  applied,  result  in  the  same  conclusion. 

We  ensure  that  the  patterns  discovered  by  the  process  are  meaningful  by  requiring  that 
we  retain  key  representative  elements  of  the  data  stream.  High  dimensional  data  is  retained 
until  the  penultimate  stage.  Information  selection  at  earlier  stages  is  designed  to  retain  a 
representation  of  the  coupled  dynamical  processes  that  underly  system  failure.  The  relative 
timing  of  events  among  multiple  units  is  a  critical  aspect  of  the  information  retained  that 
is  often  discarded  in  other  forms  of  analysis.  The  relative  timing  data  contains  the  high 
order  correlations  among  the  components  of  the  system. 

We  overcome  a  general  limitation  of  pattern  recognition  methods,  which  are  unable 
to  resolve  patterns  where  multiple  instances  of  the  same  phenomenon  do  not  appear  the 
same  in  the  input  due  to  transformations  such  as  time  or  space  translation.  To  address 
this  limitation,  we  treat  the  overall  collective  dynamics  of  the  system  as  a  single  entity. 
We  implement  a  symmetry-breaking  process  that  aligns  the  events  with  each  other  in 
time.  Such  a  symmetry-breaking  process  could  also  have  been  done  in  space,  but  was  not 
necessary  for  this  application. 

3.1  Sensor  process 

The  sensor  process  refines  large  volumes  of  variously  structured  raw  data  into  a  well-defined 
and  standardized  high-dimensional  parallel  data  stream.  This  is  analogous  to  the  brain 
converting  compressions  and  rarefactions  of  air  molecules  against  the  eardrum,  or  light 
waves  reaching  the  retina,  into  neural  signals.  The  biological  examples  demonstrate  that 
this  stage  of  the  process  is  system  specific-i.e.  the  nature  of  the  originating  data  is  specific 
to  the  system  being  considered  (sound  or  light)  and  the  purpose  of  the  sensory  stage  is  to 
use  a  system-specific  mechanism  to  convert  the  available  information  into  a  formatted  data 
stream. 

The  10  TB  of  available  data  for  Internet2  were  refined  by  a  computer  program  that 
processed  raw  network  data  into  a  dynamic  measure  of  network  interactions  while  dealing 
with  complications  like  data  inconsistencies  and  gaps.  The  available  data  consist  of  second- 
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resolution  logs  of  various  network  statistics,  including  netflow  data  containing  a  record  of 
IP  flows  passing  through  each  router,  throughput  data  consisting  of  records  of  the  average 
rate  of  successful  message  delivery,  and  usage  data  comprised  of  logs  of  system  load  for 
individual  machines  at  each  node.  The  sensor  program  parsed  these  data  and  returned  a 
time  series  of  the  most  representative  aspects  of  the  data  set  for  the  collective  behavior 
with  which  we  are  concerned  —  a  data  stream  representing  the  existence  of  a  change  in 
the  router  table  at  a  particular  router  of  the  system. 

3.2  Attention  process 

The  next  phase  of  processing  requires  that  we  specify  a  “trigger,” — a  dynamic  feature  of 
large  excursions  that  we  can  use  to  identify  when  an  extreme  event  may  be  happening. 
The  trigger  is  tuned  using  historical  data  to  maximize  the  number  of  events  identified  by 
the  event  detection  process  while  excluding  false  positives  from  the  data  set. 

The  trigger  is  based  on  an  aggregate  measure  of  the  system’s  behavior  over  space  and 
time  -  in  the  case  of  Internet2,  across  major  backbone  nodes.  Event  data  is  extracted  from 
the  data  stream  using  a  program  that  monitors  this  aggregate  measure.  A  deviation  of 
the  measure  from  a  background  value  well  above  its  statistical  variation  signals  an  event 

-  we  looked  for  deviations  larger  than  3  standard  deviations  above  the  moving  average 

-  at  which  point  the  event’s  data  stream  is  extracted.  Figure  [3]  is  a  visualization  of  an 
aggregate  measure  of  the  behavior  of  the  system,  in  which  each  bar  represents  the  number 
of  update  messages  per  day  over  seven  months.  The  figure  shows  that  update  spikes  are 
an  easily-identified  first  approximation  for  what  might  constitute  an  appropriate  trigger. 

The  next  phase  is  to  align  the  event  data;  this  is  an  essential  part  of  the  attention 
process  because  it  enables  comparison  of  the  intra-event  dynamics  of  different  events.  An 
algorithm  extracts  a  40-hour  window  of  data  surround  each  event  and  examines  it  to  identify 
the  period  within  that  window  that  best  represents  aberrant  network  activity,  and  then 
shifts  each  window  in  time  according  to  the  location  of  the  most  active  period.  In  the 
example  in  Figure  [4|  the  windows  have  been  shifted  to  align  the  largest  spikes  within  the 
window. 

The  alignment  process  outputs  a  set  of  15,000-element  vectors,  one  vector  per  event. 
Each  vector  represents  the  behavior  at  every  node  over  a  specific  time  frame,  with  the 
salient  features  of  each  event  aligned  within  the  output  matrix. 

3.3  Pattern  process 

To  identify  details  of  the  dynamics  of  large  excursions,  we  employ  a  wide  array  of  pattern 
finding  algorithms  designed  for  processing  high  dimensional,  high  volume  data.  Many  of 
these  algorithms  reduce  the  dimensionality  of  the  system  description  by  discarding  dimen¬ 
sions  that  are  not  essential  for  characterizing  the  system’s  overall  behavior.  A  common 
approach  to  dimensionality  reduction  is  to  assume  that  the  data  lie  on  an  embedded  non¬ 
linear  manifold  within  the  high-dimensional  space  defined  by  the  complete  dataset.  While 
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Figure  3:  BGP  Updates  per  day  over  seven  months  at  an  Internet2  node;  x-axis  is  days 
since  the  start  of  2008.  Arrows  indicate  days  that  are  visually  identifiable  as  “spikes”  in 
the  number  of  BGP  updates.  The  attention  process  in  a  neuromorphic  algorithm  must 
identify  the  quantitative  signature  of  such  anomalies  and  use  it  to  extract  a  data  stream 
that  represents  the  network’s  dynamical  properties. 
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Figure  4:  Aligning  events  using  their  dynamic  profiles.  The  window  at  left  depicts  the 
dynamic  profile  of  an  Internet2  node  over  several  months.  The  windows  at  right  depict  the 
profiles  of  individual  days  during  the  month  that  were  flagged  during  event  detection.  The 
alignment  process  determines  what  significant  characteristic  of  each  event  best  correlates 
to  significant  characteristics  of  other  events  and  aligns  them  using  the  resulting  criterion. 
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some  techniques  give  a  mapping  from  the  high  dimensional  space  to  the  low  dimensional 
space,  others  provide  only  a  visualization  of  the  low-dimensional  data. 

Both  types  of  algorithms  are  designed  to  maximize  coverage  of  the  lower  dimensional 
representation  space  and  minimize  the  distortion  of  the  projection.  Dimensionality  reduc¬ 
tion  algorithms  map  high-dimensional  data  vectors  in  an  input  space  of  dimension  n  to 
lower-dimensional  representation  vectors  x.L  in  an  output  space  of  dimension  m  «  n.  The 
algorithms  seek  to  preserve  the  distances  between  pairs  of  points.  Given  metrics  d %  and 
dx  that  measure  distances  between  high-dimensional  vectors  and  low-dimensional  vectors, 
respectively,  the  distances  dx  (xt ,  x3 )  approximate  the  distances  d^if,,  £/)•  At  the  same  time 
the  algorithms  try  to  maximize  a  measure  of  spatial  covering  so  that  the  representation 
vectors  Xi  represent  as  much  of  the  high  dimension  variation  in  the  lower  dimension  as 
possible. 

One  technique  for  maximizing  spatial  covering  employed  by  some  dimensionality  reduc¬ 
tion  algorithms  is  to  use  an  intermediary  transformation  from  the  input  space  to  a  feature 
space  in  which  the  underlying  structure  of  the  input  vectors  is  more  visible.  This  enables 
non-linear  methods  to  be  incorporated  in  an  otherwise  linear  process.  One  such  method 
is  Kernel  Principal  Component  Analysis  (Kernel  PCA),  in  which  the  linear  operations  of 
PCA  are  applied  to  the  feature  space  with  nonlinear  mapping.  Given  a  set  of  input  data 
points  i  =  1,  2, . . . ,  n  in  the  n-dimensional  input  space,  we  would  first  nonlinearly  trans¬ 
form  the  ?'th  input  vectors  into  a  point  $(0)  in  an  Nh  dimensional  feature  space  H  where 
each 

$(&)  =  (<M6),---,0vh(&))  e  H,  i  =  l,2,...,n.  (1) 

and  then  use  PCA  in  the  feature  space  H  [Zj.  Carrying  out  linear  PCA  in  the  feature 
space  then  yields  a  presumably  lower-dimensional  distance-preserving  representation  of 
the  input  vectors  rcj,  *  =  1,  2, . . . ,  m,  with  m  <  n.  The  method  we  employed  was  inspired 
by  Kernel  PCA;  the  nonlinear  sensor  and  attention  processes  primed  the  input  space  for 
dimensionality  reduction,  after  which  linear  methods  were  sufficient  for  identifying  structure 
in  the  data. 

The  results  of  nonlinear  dimensionality  reduction  are  visualizations  of  the  high  dimen¬ 
sional  data  in  a  lower  dimensional  space  that  make  it  possible  to  uncover  patterns  within 
the  data  using  the  coordinates  of  the  resulting  points  in  the  low  dimensional  space.  Figure[5] 
depicts  a  scatter  plot  generated  using  the  results  of  dimensionality  reduction. 

3.4  Interpretation  process 

The  pattern  finding  process  outputs  a  representation  of  the  lower-dimensional  space  to 
which  high-dimensional  input  was  mapped.  Just  as  in  a  neural  processing  system,  inter- 
pration  of  this  lower-dimensional  representation  must  be  guided  by  an  understanding  of 
the  consequences  of  previous  events,  either  by  studying  long  term  feedback  or  by  training 
from  a  previous  generation.  Similarly,  the  interpretation  of  the  events  in  the  neuromorphic 
system  can  be  guided  by  human  interpretation.  Since  the  dimensionality  of  this  output 
space  is  small,  our  own  interpretive  processes  can  identify  the  relevant  regions  of  the  space 
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Figure  5:  Dimensionality- reduced  representation  of  event  vectors.  Each  point  represents  an 
event.  This  plot  represents  an  attribute  space  of  event  parameters  found  to  be  significant  by 
the  dimensionality  reduction  algorithm.  Specifically,  xl  and  x2  are  the  two  most  prominent 
lower-dimensional  parameters.  Note  the  two  extreme  events,  which  appear  separate  from 
the  large  number  of  rerouting  events  that  did  not  destabilize  the  network. 
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from  the  historical  data. 

Extreme  events  appeared  separate  from  the  cluster  of  background  events  in  the  lower¬ 
dimensional  output  space.  They  are  visible  in  Figure  [5]  in  the  upper-left.  To  determine 
what  property  of  these  events  separates  them  from  the  trend,  we  used  radar  charts  that 
illustrated  the  node-to-node  variation  of  each  event  and  temporal  plots  to  visualize  the 
dynamics  of  the  activity. 
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Figure  6:  Dynamic  profiles  for  the  two  events.  The  insets  indicate  the  magnitude  of  each 
event  at  each  node.  Also  indicated  is  where  each  event  appeared  on  the  dimensionality- 
reduced  plot. 

Figure  [6]  contains  two  such  plots,  along  with  temporal  plots  and  indications  of  where 
each  event  falls  in  Figure  [5|  The  radar  chart  insets  indicate  the  magnitude  of  each  event 
at  each  node.  Clearly  visible  in  the  first  of  the  two  events,  which  manifested  at  every  node 
but  was  aberrantly  large  at  only  one  node,  are  several  distinct  spikes  in  network  activity. 
This  repeated  and  persistent  aberrant  activity  is  a  signature  of  systemic  instability.  The 
second  event  depicted  consisted  of  nearly  eight  hours  of  large  numbers  of  updates.  The 
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entire  network  was  forced  to  completely  rewire  itself  every  30  seconds.  This  is  precisely  the 
type  of  system  failure  our  method  is  designed  to  detect. 

The  results  of  our  analysis  prompted  us  to  revisit  the  theoretical  nature  of  vulnerability 
and  failure.  Within  the  context  of  vulnerable  systems,  large  cascades  are  common  rather 
than  isolated  events.  System  failure  is  a  persistent  and  recurrent  cascade.  Thus,  both  vul¬ 
nerability  and  failure  can  be  identified  as  persistent  large  deviations  from  normal  behavior. 
Our  processing  pipeline  is  well-suited  to  detecting  such  events  because  of  the  attentional 
trigger  which  aligns  events  according  to  their  largest  excursion.  All  events  where  the  large 
excursion  is  sufficiently  isolated  from  other  large  events  will  appear  much  more  similar  to 
each  other  than  they  do  to  events  for  which  multiple  large  excursions  occur  over  time  and 
across  the  network.  This  ensures  that  the  pattern  recognition  algorithms  will  be  able  to 
distinguish  between  the  two  types. 

Our  method  sheds  light  on  the  dynamical  characteristics  of  extreme  events  and  explains 
why  our  processing  pipeline  can  distinguish  extreme  events  from  those  that  do  not  result  in 
system  failure.  This  new  insight  provides  a  general  explanation  of  how  and  why  real-time 
detection  of  extreme  events  is  possible. 

4  Conclusion 

We  have  developed  a  neuromorphic  information  processing  pipeline  that  can  characterize 
the  vulnerability  of  complex  systems.  The  process  consists  of  extracting  a  dynamic  measure 
of  network  activity  and  processing  the  resulting  time  series  to  find  patterns  of  collective 
behavior.  The  process  succeeded  in  identifying  extreme  events  that  are  distinct  from  high 
demand  but  otherwise  effective  system  activity.  Novel  spatiotemporal  analysis  and  dimen¬ 
sionality  reduction  techniques  made  this  result  possible.  The  pipeline  can  be  used  quite 
generally  for  analyzing  high-dimensional  time  series  and  isolating  extreme  events  in  real 
world  communication,  transportation  and  economic  systems.  This  system  can  be  combined 
with  real-time  system  monitoring  of  data  streams  to  identify  dysfunctional  behaviors  and 
characterize  vulnerabilities  or  system  instabilities  as  they  occur. 
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